RHSA-2026:5851HighCVSS 7.5

Red Hat Security Advisory: DevWorkspace Operator 0.40.0 release.

Published
March 25, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (4)

CVE-2025-61726 →CVE-2025-61728 →CVE-2025-61729 →CVE-2025-68121 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61728 — golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

🎯 Affected products14

  • DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-operator-bundle@sha256:b22a283fc83e7b6d99cd35afd6c8b066026fb8699a7d48a64eceea1f7a4262c5_amd64 as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:0d1a98bd35453d85403050bf2d5a60399048bef2d9a01b44438da3fc991cdddc_amd64 as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:662efae63c52da171bef532813311884c14d24dfe561ed338298965d1b49e1ea_ppc64le as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:812e9962c2b538d56054b0373df679f02e92f47457049a5acda883d047816464_arm64 as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-project-backup-rhel9@sha256:ab53d75e3c7adb9f71d5c3e69158bee347767f4935dcea57af1a55528c4b6e4f_s390x as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:11c561bf7aac3f3ac3adfbc437a3f56ef7fdf494f02c161bde982156b36d8b30_amd64 as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:16c8a2101e6d1cb0db4834d42fe8b9bfa24e70dd2c03691cd5e5e6d7c2d1de53_s390x as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:955b69b44e7678aa7cac4d88f3142a2e4c44fe586ecf521034ebae40539e8514_arm64 as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-project-clone-rhel9@sha256:bf5514d940f858292f98853f4a939d8e89977f0bc72b5be34304bfb60b52ee50_ppc64le as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:030160d105ab2fd0f9815527f1b37055c4f734bee9f37f7ea923a506f8e39c30_amd64 as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:783ba2b9c36eabf2d04c30be1fd025502dacfd9138e9650c1d91dc7670c50faf_arm64 as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:90826bb4d26aa81609923bf06310f98ffcc01754bf21d6b78123b1e1dff39645_s390x as a component of DevWorkspace Operator 0.4
  • registry.redhat.io/devworkspace/devworkspace-rhel9-operator@sha256:de7e7e42e24111905f25990ed89adfbaee8b4467b9889142dff6091f4719da44_ppc64le as a component of DevWorkspace Operator 0.4

✅ Remediation

To start using the DevWorkspace Operator, install the DevWorkspace Operator from OpenShift OperatorHub on OpenShift Container Platform 4.16 or higher. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.

🔗 References (8)